extract API key from URL instead of user prefs, because sandbox